← Back to issue list

build(autogen): bump dependencies to resolve OSVs

View original Github issue

Metadata

Project
imagecraft
Number
#247
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged #247 via commit 603fbc3, updating filelock 3.20.2, fonttools 4.61.1, and urllib3 2.6.2 to resolve OSV warnings; all CI checks passed.

Resolution: closed resolved

Reason: The dependency lockfile updates were merged in commit 603fbc3 and passed all reported CI and security checks, including OSV-scanner and Trivy.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps dependencies to resolve some OSV warnings. ``` ❯ uv lock -P urllib3 -P fonttools -P filelock Resolved 170 packages in 1.68s Updated filelock v3.19.1 -> v3.20.2 Updated fonttools v4.60.1 -> v4.61.1 Updated urllib3 v2.5.0 -> v2.6.2 ``` --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged #247 via commit 603fbc3, updating filelock 3.20.2, fonttools 4.61.1, and urllib3 2.6.2 to resolve OSV warnings; all CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged #247 in commit 603fbc3, updating filelock to 3.20.2, fonttools to 4.61.1, and urllib3 to 2.6.2 to address OSV warnings. All CI checks passed.
qwen/qwen3.6-35b-a3b — — Merged after passing CI and receiving two approvals. Updated filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated Spread test failure was noted but did not block the merge.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency updates for filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated spread test issue was noted during review but did not block the merge.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#342 build(autogen): bump libraries to fix OSVs craft-store merged Autogenerated lockfile PR by maintainer bepri merged as commit 7a0dbd3, bumping cffi 1.17.1->2.0.0, filelock, jaraco-context, protobuf 6.33.5, pynacl 1.6.2, urllib3 2.6.3 and wheel 0.46.3 to clear OSV scanner/Trivy findings.
81%
#457 build(autogen): bump dependencies craft-cli merged Merged as commit e5a1243 (build(autogen): bump dependencies (#457)) by maintainer bepri, bumping build/doc dependencies to resolve a batch of OSVs; all CI, lint, security scan and policy checks passed.
80%
#1791 build(deps): bump dependencies for OSV warnings craft-parts merged Merged PR #1791 bumping certifi and urllib3 to resolve OSV security warnings.
75%
#180 build(deps): resolve OSVs craft-grammar merged Merged #180 in commit 983ae56, updating uv.lock to pytest 9.0.3 from 9.0.2 to resolve OSV findings; all CI checks passed.
74%
#143 build(deps): resolve OSVs debcraft merged Merged in canonical/debcraft#143 as commit 3e9db88, updating idna 3.10→3.18 and urllib3 2.6.3→2.7.0 to resolve OSV findings. All CI checks passed.
74%
#262 build(deps): update filelock for OSV imagecraft merged Merged PR #262 bumped the filelock dependency for an OSV advisory; landed on main as commit 96ff5ed ("build(deps): update filelock for OSV (#262)"), with all CI checks green.
74%
#353 build(deps): bump libraries for OSVs craft-store merged Merged dependabot-style PR bumping cryptography 44.0.2→46.0.6, Markdown 3.8→3.10.2 and Pygments 2.19.1→2.20.0 in uv.lock to clear outstanding OSVs (commit 98818d8).
73%
#164 build(autogen): bump urllib3 imagecraft merged Merged as commit 4443100: bumped urllib3 via `uv sync --upgrade-package urllib3` (+3/-3, 1 file) to stop shipping a vulnerable version, despite spread test failures on Ubuntu 20.04/22.04/24.04.
72%
#5871 build(autogen): bump pip for OSV snapcraft merged Merged as commit 1581acb11, upgrading pip 25.2→25.3 for GHSA-4xh5-x5gv-qwph and refreshing python-apt lock entries.
72%
#131 build(deps): resolve OSVs debcraft merged Merged as commit 509e420: routine 'build(deps): resolve OSVs' uv.lock update (cryptography 46.0.7, pygments 2.20.0, pytest 9.0.3, requests 2.33.1) that incidentally bumped craft-parts, causing a StepInfo regression.
72%